@tokenoftrust/storefront-runner 2.4.49 → 2.4.51

package/apps/storefront/src/pages/api/commerce/checkout-handoff.ts

@@ -18,8 +18,15 @@
  *     unattributed response; the handoff proceeds, checkout is never blocked.
  */
 import type { APIContext } from "astro";
-import { parseConsentSnapshot, defaultConsentSnapshot } from "@tot/public-runtime";
+import {
+  enforceCartSubmission,
+  foxyCartRedirectUrl,
+  parseConsentSnapshot,
+  defaultConsentSnapshot,
+  type CartDenialCode,
+} from "@tot/public-runtime";
 import { resolveCheckoutHandoffCorrelation } from "@/lib/commerce/checkoutHandoffCorrelation";
+import { resolveCartSigning } from "@/lib/checkoutCommerce";
 
 export const prerender = false;
 
@@ -38,7 +45,78 @@ interface HandoffBody {
   consent?: unknown;
 }
 
+function escapeHtml(value: string): string {
+  return value.replace(/[&<>"']/g, (ch) => {
+    if (ch === "&") return "&amp;";
+    if (ch === "<") return "&lt;";
+    if (ch === ">") return "&gt;";
+    if (ch === '"') return "&quot;";
+    return "&#39;";
+  });
+}
+
+function cartDenial(code: CartDenialCode, message: string, status: number): Response {
+  const body =
+    `<!doctype html><html><body><p data-cart-denial="${code}" data-payment-authorized="false">${escapeHtml(message)}</p></body></html>`;
+  return new Response(body, {
+    status,
+    headers: {
+      "content-type": "text/html; charset=utf-8",
+      "cache-control": "no-store",
+      "x-tot-payment-authorized": "false",
+    },
+  });
+}
+
+function isCartForm(request: Request): boolean {
+  const type = request.headers.get("content-type") ?? "";
+  return (
+    type.includes("application/x-www-form-urlencoded") ||
+    type.includes("multipart/form-data")
+  );
+}
+
+/** Native cart POST. Browser preflight is not consulted. Payment is never authorized. */
+async function cartFormPost(context: APIContext): Promise<Response> {
+  const { tenant, commerce } = context.locals;
+  if (!commerce) {
+    return cartDenial(
+      "signing-unavailable",
+      "Checkout is unavailable because this store has no cart configured.",
+      409,
+    );
+  }
+  const signing = await resolveCartSigning(commerce);
+  if (!signing.enabled) {
+    return cartDenial("signing-unavailable", signing.operatorError ?? "Signed checkout is unavailable.", 503);
+  }
+  const form = await context.request.formData();
+  const entries: Array<[string, string]> = [];
+  for (const [name, value] of form.entries()) {
+    if (typeof value === "string") entries.push([name, value]);
+  }
+  const result = await enforceCartSubmission({
+    entries,
+    mode: commerce.mode,
+    secret: signing.secret,
+    trustedTenantId: tenant.tenant_id,
+  });
+  if (!result.ok) {
+    const status = result.code === "signing-unavailable" ? 503 : 422;
+    return cartDenial(result.code, result.message, status);
+  }
+  return new Response(null, {
+    status: 303,
+    headers: {
+      location: foxyCartRedirectUrl(commerce.cartUrl, result.fields),
+      "cache-control": "no-store",
+      "x-tot-payment-authorized": "false",
+    },
+  });
+}
+
 export async function POST(context: APIContext): Promise<Response> {
+  if (isCartForm(context.request)) return cartFormPost(context);
   const { tenant, browserEnvironment, commerce } = context.locals;
 
   // No managed checkout on this tenant → nothing to attribute.

package/apps/storefront/src/pages/api/commerce/final-cart-authorization.ts

@@ -0,0 +1,366 @@
+/**
+ * POST /api/commerce/final-cart-authorization — time-limited final-cart admission.
+ * Caller-owned asymmetric tokens only. Catalog availability, a browser confirmation,
+ * and missing verification evidence do not authorize payment.
+ */
+import type { APIContext } from "astro";
+import { createLocalJWKSet, decodeJwt, decodeProtectedHeader, jwtVerify, type JSONWebKeySet, type JWTPayload } from "jose";
+import type { TenantConfig } from "@tot/public-runtime";
+import {
+  type CallerToken,
+  type CommerceEvidence,
+  type CommerceStage,
+  type EvidenceState,
+  type FinalCartBinding,
+  type FulfillmentState,
+  type LabelState,
+  type PaymentState,
+  type StockState,
+} from "@tot/public-runtime";
+import { fromD1, listAllActiveProducts } from "@/lib/d1/catalog.js";
+import { readD1, readEnv } from "@/lib/env";
+import { evaluateFinalCart, type SeamView } from "@/lib/commerce/finalCartAuthorization.js";
+import { d1CommerceRunner, mirrorOnHand, reserveAllocation } from "@/lib/inventory/allocations.js";
+import { POST as compliancePreflight } from "../compliance/preflight.js";
+
+export const prerender = false;
+
+const EVIDENCE_STATES = new Set(["fresh", "UNKNOWN", "stale", "unreadable", "absent"]);
+const STAGES = new Set(["preview", "publication"]);
+
+function json(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" },
+  });
+}
+
+function deny(finding: string, status: number, owner?: string): Response {
+  return json(owner ? { ok: false, finding, owner } : { ok: false, finding }, status);
+}
+
+function statusFor(finding: string): number {
+  if (finding === "store-unconfigured" || finding === "caller-unconfigured") return 503;
+  if (
+    finding === "browser-not-authority" ||
+    finding === "tenant-unbound" ||
+    finding === "shared-secret" ||
+    finding === "signature" ||
+    finding === "kid" ||
+    finding === "issuer" ||
+    finding === "audience" ||
+    finding === "expired" ||
+    finding === "lifetime" ||
+    finding === "jti" ||
+    finding === "tenant" ||
+    finding === "stage"
+  ) {
+    return 401;
+  }
+  return 409;
+}
+
+function claimString(payload: JWTPayload, key: string): string {
+  const value = payload[key];
+  return typeof value === "string" ? value : "";
+}
+
+function parseList(value: string | undefined): string[] | null {
+  if (!value || value.trim() === "") return null;
+  const trimmed = value.trim();
+  if (trimmed.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(trimmed) as unknown;
+      if (!Array.isArray(parsed) || parsed.some((item) => typeof item !== "string" || item.trim() === "")) return null;
+      return parsed as string[];
+    } catch {
+      return null;
+    }
+  }
+  const parts = trimmed.split(",").map((part) => part.trim()).filter(Boolean);
+  return parts.length > 0 ? parts : null;
+}
+
+function publicJwks(value: string | undefined): JSONWebKeySet | null {
+  if (!value) return null;
+  try {
+    const parsed = JSON.parse(value) as unknown;
+    if (!parsed || typeof parsed !== "object" || !Array.isArray((parsed as { keys?: unknown }).keys)) return null;
+    const keys = (parsed as { keys: unknown[] }).keys;
+    if (keys.length < 1) return null;
+    for (const key of keys) {
+      if (!key || typeof key !== "object") return null;
+      const record = key as Record<string, unknown>;
+      if (typeof record.d === "string" || record.kty === "oct" || typeof record.k === "string") return null;
+    }
+    return parsed as JSONWebKeySet;
+  } catch {
+    return null;
+  }
+}
+
+function readCart(value: unknown): FinalCartBinding | null {
+  if (!value || typeof value !== "object") return null;
+  const record = value as Record<string, unknown>;
+  if (typeof record.tenantId !== "string" || typeof record.currency !== "string" || typeof record.destinationDigest !== "string") {
+    return null;
+  }
+  if (typeof record.stage !== "string" || !STAGES.has(record.stage)) return null;
+  if (typeof record.verificationExpiresAt !== "string" || typeof record.taxExpiresAt !== "string") return null;
+  if (!Array.isArray(record.lines) || record.lines.length > 50) return null;
+  const lines = [];
+  for (const line of record.lines) {
+    if (!line || typeof line !== "object") return null;
+    const row = line as Record<string, unknown>;
+    if (typeof row.sku !== "string" || typeof row.quantity !== "number" || typeof row.unitMinor !== "number") return null;
+    lines.push({ sku: row.sku, quantity: row.quantity, unitMinor: row.unitMinor });
+  }
+  return {
+    tenantId: record.tenantId,
+    stage: record.stage as CommerceStage,
+    currency: record.currency,
+    lines,
+    destinationDigest: record.destinationDigest,
+    verificationExpiresAt: record.verificationExpiresAt,
+    taxExpiresAt: record.taxExpiresAt,
+  };
+}
+
+function readEvidence(value: unknown): CommerceEvidence | null {
+  if (!value || typeof value !== "object") return null;
+  const record = value as Record<string, unknown>;
+  const evidence = {} as CommerceEvidence;
+  for (const field of ["verification", "tax", "risk", "stock"] as const) {
+    const state = record[field];
+    if (typeof state !== "string" || !EVIDENCE_STATES.has(state)) return null;
+    evidence[field] = state as EvidenceState;
+  }
+  return evidence;
+}
+
+function readState<T extends string>(value: unknown, allowed: readonly T[]): T | undefined {
+  return typeof value === "string" && (allowed as readonly string[]).includes(value) ? (value as T) : undefined;
+}
+
+function destinationOf(value: unknown): { region: string; country: string } | null {
+  if (!value || typeof value !== "object") return null;
+  const record = value as Record<string, unknown>;
+  const region = typeof record.region === "string" ? record.region.trim() : "";
+  const country = typeof record.country === "string" ? record.country.trim() : "";
+  if (!/^[A-Za-z]{2}$/.test(region)) return null;
+  if (country !== "" && !/^[A-Za-z]{2}$/.test(country)) return null;
+  return { region: region.toUpperCase(), country: country === "" ? "US" : country.toUpperCase() };
+}
+
+async function catalogOffers(sku: string): Promise<boolean> {
+  const database = await readD1("CATALOG_DB");
+  if (!database) return false;
+  try {
+    const products = await listAllActiveProducts(fromD1(database));
+    for (const product of products) {
+      for (const variant of product.variants) {
+        if (variant.sku === sku && variant.inventory.available === true) return true;
+      }
+    }
+  } catch {
+    return false;
+  }
+  return false;
+}
+
+async function verificationSeam(
+  context: APIContext,
+  cart: FinalCartBinding,
+  destination: { region: string; country: string } | null,
+): Promise<SeamView> {
+  const tot = (context.locals as { tot?: { getProductByHandle: (handle: string) => Promise<unknown> } }).tot ?? {
+    getProductByHandle: async () => null,
+  };
+  const response = await compliancePreflight({
+    request: new Request("https://synthetic-tenant.invalid/api/compliance/preflight", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        lines: cart.lines.map((line) => ({ handle: line.sku, sku: line.sku, quantity: line.quantity })),
+        ...(destination ? { destination: { region: destination.region, country: destination.country } } : {}),
+      }),
+    }),
+    locals: { tenant: context.locals.tenant, tot },
+  } as APIContext);
+  let body: unknown;
+  try {
+    body = await response.json();
+  } catch {
+    return { status: "absent" };
+  }
+  const decision = body && typeof body === "object" ? (body as { decision?: { status?: unknown; failedClosed?: unknown; blocks?: unknown } }).decision : undefined;
+  if (!decision || decision.status === "clear") return { status: decision ? "clear" : "absent" };
+  const blocks = Array.isArray(decision.blocks) ? decision.blocks : [];
+  const codes = blocks
+    .map((block) => (block && typeof block === "object" ? (block as { code?: unknown }).code : undefined))
+    .filter((code): code is string => typeof code === "string");
+  return { status: "blocked", failedClosed: decision.failedClosed === true, codes };
+}
+
+export async function POST(context: APIContext): Promise<Response> {
+  const tenant = context.locals.tenant as TenantConfig | undefined;
+  const appDomain = tenant?.appDomain ?? "";
+  if (!tenant || appDomain === "") return deny("tenant-unbound", 401);
+
+  let body: Record<string, unknown>;
+  try {
+    const parsed = await context.request.json();
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return deny("malformed-request", 409);
+    body = parsed as Record<string, unknown>;
+  } catch {
+    return deny("malformed-request", 409);
+  }
+
+  if (body.scheme === "shared-secret") {
+    const decision = await evaluateFinalCart({
+      now: new Date().toISOString(),
+      routedTenantId: appDomain,
+      quoted: readCart(body.quoted) ?? emptyCart(appDomain),
+      presented: readCart(body.presented) ?? emptyCart(appDomain),
+      evidence: readEvidence(body.evidence),
+      seam: { status: "clear" },
+      catalogAvailable: false,
+      browserConfirmed: body.browserConfirmed === true,
+      token: { scheme: "shared-secret" },
+      trustedIssuers: [],
+      expectedAudience: "",
+      activeKids: [],
+      authorities: [],
+    });
+    return deny(decision.ok ? "shared-secret" : decision.finding, statusFor(decision.ok ? "shared-secret" : decision.finding), decision.ok ? undefined : decision.owner);
+  }
+
+  const quoted = readCart(body.quoted);
+  const presented = readCart(body.presented);
+  if (!quoted || !presented) return deny("malformed-request", 409);
+
+  const jwks = publicJwks(await readEnv("SCRAPPY_CALLER_JWKS"));
+  const issuers = parseList(await readEnv("SCRAPPY_CALLER_ISSUERS"));
+  const audience = await readEnv("SCRAPPY_CALLER_AUDIENCE");
+  const activeKids = parseList(await readEnv("SCRAPPY_CALLER_ACTIVE_KIDS"));
+  if (!jwks || !issuers || !audience || !activeKids) return deny("caller-unconfigured", 503);
+
+  const header = context.request.headers.get("authorization") ?? "";
+  const bearer = header.startsWith("Bearer ") ? header.slice("Bearer ".length).trim() : "";
+  let token: CallerToken | null = null;
+  if (bearer !== "") {
+    try {
+      const decoded = decodeJwt(bearer);
+      const protectedHeader = decodeProtectedHeader(bearer);
+      let signatureValid = false;
+      try {
+        await jwtVerify(bearer, createLocalJWKSet(jwks), { algorithms: ["EdDSA"] });
+        signatureValid = true;
+      } catch (error) {
+        const code = error && typeof error === "object" && "code" in error ? String((error as { code: unknown }).code) : "";
+        signatureValid = code === "ERR_JWT_EXPIRED" || code === "ERR_JWT_CLAIM_VALIDATION_FAILED";
+      }
+      const exp = typeof decoded.exp === "number" ? new Date(decoded.exp * 1000).toISOString() : "";
+      const audienceClaim = typeof decoded.aud === "string" ? decoded.aud : Array.isArray(decoded.aud) ? decoded.aud[0] ?? "" : "";
+      const stageClaim = claimString(decoded, "stage");
+      const stage: CommerceStage =
+        stageClaim === "preview" || stageClaim === "publication"
+          ? stageClaim
+          : presented.stage === "preview"
+            ? "publication"
+            : "preview";
+      token = {
+        scheme: "asymmetric-jwks",
+        signatureValid,
+        kid: typeof protectedHeader.kid === "string" ? protectedHeader.kid : "",
+        issuer: typeof decoded.iss === "string" ? decoded.iss : "",
+        audience: audienceClaim,
+        expiresAt: exp,
+        jti: claimString(decoded, "jti"),
+        tenantId: claimString(decoded, "tenantId"),
+        stage,
+      };
+    } catch {
+      token = null;
+    }
+  }
+
+  const provider = tenant.inventory?.provider ?? "mirror";
+  const authorities: unknown[] = [];
+  const now = new Date().toISOString();
+  if (provider !== "mirror") {
+    authorities.push({ provider, sku: presented.lines[0]?.sku });
+  } else {
+    const skus = [...new Set(presented.lines.map((line) => line.sku))];
+    for (const sku of skus) {
+      const onHand = mirrorOnHand(sku, "unspecified");
+      authorities.push(
+        onHand == null
+          ? null
+          : { provider: "mirror", readable: true, locationId: "unspecified", sku, onHand, asOf: now },
+      );
+    }
+  }
+  let catalogAvailable = false;
+  for (const line of presented.lines) {
+    if (await catalogOffers(line.sku)) catalogAvailable = true;
+  }
+
+  const decision = await evaluateFinalCart({
+    now,
+    routedTenantId: appDomain,
+    quoted,
+    presented,
+    evidence: readEvidence(body.evidence),
+    seam: await verificationSeam(context, presented, destinationOf(body.destination)),
+    catalogAvailable,
+    browserConfirmed: body.browserConfirmed === true,
+    token,
+    trustedIssuers: issuers,
+    expectedAudience: audience,
+    activeKids,
+    authorities,
+    payment: readState<PaymentState>(body.payment, ["UNKNOWN", "pending", "authorized", "captured", "capture_unknown", "voided", "refund_requested", "refunded", "refund_unknown"]),
+    stock: readState<StockState>(body.stock, ["UNKNOWN", "unallocated", "reserved", "confirmed", "released", "expired"]),
+    fulfillment: readState<FulfillmentState>(body.fulfillment, ["UNKNOWN", "held", "ready", "handed_off", "cancelled"]),
+    label: readState<LabelState>(body.label, ["UNKNOWN", "none", "intent", "purchased", "printed", "void_requested", "voided"]),
+  });
+  if (!decision.ok) return deny(decision.finding, statusFor(decision.finding), decision.owner);
+
+  const database = await readD1("STOREFRONT_APPS_DB");
+  if (!database || typeof database.prepare !== "function") return deny("store-unconfigured", 503);
+  const reserved = await reserveAllocation(d1CommerceRunner(database), {
+    tenantId: decision.tenantId,
+    stage: decision.stage,
+    orderId: `a${crypto.randomUUID()}`,
+    cartDigest: decision.digest,
+    expiresAt: decision.expiresAt,
+    now,
+    currency: presented.currency,
+    amountMinor: decision.amountMinor,
+    issuer: decision.issuer,
+    jti: decision.jti,
+    holds: decision.holds,
+  });
+  if (!reserved.ok) return deny(reserved.finding, statusFor(reserved.finding));
+  return json({
+    ok: true,
+    authorizationId: reserved.authorizationId,
+    cartDigest: decision.digest,
+    expiresAt: reserved.expiresAt,
+    repeated: reserved.repeated,
+    stage: decision.stage,
+  });
+}
+
+function emptyCart(tenantId: string): FinalCartBinding {
+  return {
+    tenantId,
+    stage: "preview",
+    currency: "USD",
+    lines: [{ sku: "sku-1", quantity: 1, unitMinor: 0 }],
+    destinationDigest: "dest-synthetic",
+    verificationExpiresAt: "1970-01-01T00:00:00.000Z",
+    taxExpiresAt: "1970-01-01T00:00:00.000Z",
+  };
+}

package/apps/storefront/src/pages/products/[handle].astro

@@ -21,7 +21,9 @@ import ReviewSummary from "@/components/commerce/ReviewSummary.astro";
 import ReviewList from "@/components/commerce/ReviewList.astro";
 import { isOnSale, isNew, isAvailable, fromPrice } from "@/lib/tot/query";
 import {
-  buildMemberSignedCartPayload,
+  buildVariantCartPayload,
+  priceForPurchaseOption,
+  workerCartApiPath,
   normalizePurchaseOptions,
   visiblePurchaseOptions,
   isAutopilotEnabled,
@@ -208,6 +210,13 @@ const autopilotEnabled = isAutopilotEnabled(tenant.commerce?.autopilot);
 // list/subscription price; a Phase-2 member request signs their member price.
 const pricingCtx: PurchaseOptionPricingContext = { member, program: membershipProgram };
 
+const cartApiPath = workerCartApiPath({
+  provider: tenant.serving?.provider ?? "worker-r2-pointer",
+  phase: Astro.locals.browserEnvironment.environment === "live" ? "publication" : "preview",
+  apiBasePath,
+  endpoint: "/api/commerce/checkout-handoff",
+});
+
 let checkoutCart:
   | {
       action: string;
@@ -215,12 +224,15 @@ let checkoutCart:
       byVariantId: Record<string, Record<string, VariantCartPayload>>;
     }
   | undefined;
+let cartOperatorError: string | undefined;
 if (commerce) {
   // Fail closed for production signed checkout: a signed tenant with no
   // cart-validation secret builds NO cart (never a tamperable form). See
   // resolveCartSigning — it also logs the misconfiguration loudly.
-  const { enabled, secret } = await resolveCartSigning(commerce);
-  if (enabled) {
+  const signing = await resolveCartSigning(commerce);
+  if (!signing.enabled) {
+    cartOperatorError = signing.operatorError;
+  } else {
     try {
       const purchaseOptions = visiblePurchaseOptions(
         normalizePurchaseOptions(product),
@@ -230,33 +242,41 @@ if (commerce) {
         product.variants.map(
           async (v) => {
             const payloads = await Promise.all(
-              purchaseOptions.map(
-                async (purchaseOption) =>
-                  [
-                    purchaseOption.id,
-                    await buildMemberSignedCartPayload(product, v, {
-                      mode: commerce.mode,
-                      secret,
-                      purchaseOption,
-                      pricing: pricingCtx,
-                      autopilotEnabled,
-                    }),
-                  ] as const,
-              ),
+              purchaseOptions.map(async (purchaseOption) => {
+                const effective = priceForPurchaseOption(
+                  v.price,
+                  purchaseOption,
+                  pricingCtx,
+                );
+                return [
+                  purchaseOption.id,
+                  await buildVariantCartPayload(product, v, {
+                    mode: commerce.mode,
+                    secret: signing.secret,
+                    purchaseOption,
+                    signedPrice: effective.price,
+                    autopilotEnabled,
+                    tenantId: tenant.tenant_id,
+                  }),
+                ] as const;
+              }),
             );
             return [v.id, Object.fromEntries(payloads)] as const;
           },
         ),
       );
       checkoutCart = {
-        action: commerce.cartUrl,
+        action: cartApiPath,
         purchaseOptions,
         byVariantId: Object.fromEntries(entries),
       };
     } catch (err) {
+      cartOperatorError =
+        err instanceof Error && err.name === "CartSigningUnavailableError"
+          ? err.message
+          : undefined;
       console.warn(
         `[storefront] Invalid checkout purchase options for ${product.handle}; cart disabled for this product.`,
-        err,
       );
     }
   }
@@ -368,8 +388,15 @@ const jsonLd = [productJsonLd, breadcrumbLd(crumbs, canonicalBase)];
         </div>
       )}
 
-      {/* Variant selector island owns live price/SKU/availability + buy CTA. */}
-      <div class="mt-7">
+      {/* Variant selector island owns live price/SKU/availability + buy CTA.
+          The form action is the worker cart route, so a native submit reaches
+          the server check. A clear browser preflight is not payment authority. */}
+      <div class="mt-7" data-payment-authority="none">
+        {cartOperatorError && (
+          <p class="mb-3 text-sm text-[var(--color-text)]" role="alert" data-cart-operator-error>
+            {cartOperatorError}
+          </p>
+        )}
         <VariantSelector
           client:load
           variants={publicSelectorVariants(product.variants)}
@@ -380,7 +407,7 @@ const jsonLd = [productJsonLd, breadcrumbLd(crumbs, canonicalBase)];
           productTitle={product.title}
           checkoutCart={checkoutCart}
           pricing={pricing}
-          handoffUrl={withBase(apiBasePath, "/api/commerce/checkout-handoff")}
+          handoffUrl={cartApiPath}
         />
         {/* Regulated-tenant checkout ENFORCEMENT gate. Intercepts the
             managed-cart handoff to clear age + ship-to compliance server-side

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/storefront-runner",
-  "version": "2.4.49",
+  "version": "2.4.51",
   "license": "SEE LICENSE IN LICENSE",
   "description": "World-shareable storefront runner: multi-tenant renderer on Astro/Cloudflare. No control plane.",
   "packageManager": "pnpm@11.9.0",